refactor(auth): extract NextAuth config to shared lib module

Move the NextAuth v4 configuration from the route handler
(src/app/api/auth/[...nextauth]/route.ts) into a dedicated module
(src/lib/auth/auth.ts) to establish a single source of truth. The
route file now simply re-exports the handler from the shared
module, keeping provider setup, JWT/session callbacks, and
environment variable references in one reusable location.

src/lib/auth/auth.ts

@@ -0,0 +1,46 @@
+/**
+ * NextAuth v4 配置（单一来源）
+ *
+ * v4 模式：`NextAuth(options)` 返回单个 handler 函数。
+ * route 绑定在 `src/app/api/auth/[...nextauth]/route.ts`。
+ *
+ * 客户端通过 `src/lib/auth/{auth_platform,logout}.ts` 触发。
+ */
+import NextAuth from "next-auth";
+import Google from "next-auth/providers/google";
+import Facebook from "next-auth/providers/facebook";
+
+export const handler = NextAuth({
+  providers: [
+    Google({
+      clientId: process.env.AUTH_GOOGLE_ID ?? "",
+      clientSecret: process.env.AUTH_GOOGLE_SECRET ?? "",
+    }),
+    Facebook({
+      clientId: process.env.AUTH_FACEBOOK_ID ?? "",
+      clientSecret: process.env.AUTH_FACEBOOK_SECRET ?? "",
+    }),
+  ],
+  // 把 OAuth provider 的 token 塞进 NextAuth session，供前端取用：
+  //   - Google: account.id_token     → 调后端 /api/auth/google-login 换业务 token
+  //   - Facebook: account.access_token → 调后端 /api/auth/facebook-login
+  // 仅在**首次 sign-in** 时把 `account` 注入到 JWT；后续请求 account=undefined
+  // （由 NextAuth 控制），所以下面的 `if (account)` 守卫是必要的。
+  callbacks: {
+    async jwt({ token, account }) {
+      if (account) {
+        token.provider = account.provider;
+        token.idToken = account.id_token;
+        token.accessToken = account.access_token;
+      }
+      return token;
+    },
+    async session({ session, token }) {
+      // 暴露给 `useSession()` —— 仅 client-side 派发 sync 事件时使用，不落 localStorage
+      session.provider = (token.provider as "google" | "facebook" | undefined) ?? undefined;
+      session.idToken = (token.idToken as string | undefined) ?? undefined;
+      session.accessToken = (token.accessToken as string | undefined) ?? undefined;
+      return session;
+    },
+  },
+});